live migration: ram_save_setup failed: Input/output error

[Corsin]

Hi,
when trying to run a live migration of a vm i get the following error

qm migrate 20086 pve-1 --online
Authorized uses only. All activity may be monitored and reported.
2026-03-04 07:20:42 use dedicated network address for sending migration traffic (***)
2026-03-04 07:20:42 starting migration of VM 20086 to node 'pve-1' (***)
2026-03-04 07:20:42 starting VM 20086 on remote node 'pve-1'
2026-03-04 07:20:42 [pve-1 Authorized uses only. All activity may be monitored and reported.
2026-03-04 07:20:44 start remote tunnel
Authorized uses only. All activity may be monitored and reported.
2026-03-04 07:20:45 ssh tunnel ver 1
2026-03-04 07:20:45 starting online/live migration on unix:/run/qemu-server/20086.migrate
2026-03-04 07:20:45 set migration capabilities
2026-03-04 07:20:45 migration downtime limit: 100 ms
2026-03-04 07:20:45 migration cachesize: 8.0 GiB
2026-03-04 07:20:45 set migration parameters
2026-03-04 07:20:45 start migrate command to unix:/run/qemu-server/20086.migrate
channel 2: open failed: connect failed: open failed
2026-03-04 07:20:46 migration status error: failed - ram_save_setup failed: Input/output error
2026-03-04 07:20:46 ERROR: online migrate failure - aborting
2026-03-04 07:20:46 aborting phase 2 - cleanup resources
2026-03-04 07:20:46 migrate_cancel
Authorized uses only. All activity may be monitored and reported.
2026-03-04 07:20:48 ERROR: migration finished with problems (duration 00:00:06)
migration problems

On the receiving node i see the following error in the journal

 sshd[614104]: Received request to connect to path /run/qemu-server/20086.migrate, but the request was denied.

SSH from one node to the other works and also migrating the vm when stopped works without any issues.
Does anyone have an idea what could possibly be wrong? Thanks in advance.

Spoiler: PVE Version

pveversion pve-manager/8.4.14/b502d23c55afcba1 (running kernel: 6.8.12-9-pve)

 

[fabian]

Authorized uses only. All activity may be monitored and reported.
channel 2: open failed: connect failed: open failed

your SSH config is likely not suitable for migrating using SSH.

 

[Corsin]

Thx for the hint.
AllowTcpForwarding was set to no by a hardening script.

 

[iwik]

Thx for the hint.
AllowTcpForwarding was set to no by a hardening script.

Same here
EDIT: Also, when you are using veeam, backup fails with general error

Failed to connect the NBD server to the hypervisor host​

So let's it write here, so others can find it, since I did not google it anywhere, this can be root cause.

 

[spirit]

for hardening, you can do something like

DisableForwarding yes
Match User root Address <<10.0.10.0/24,10.0.20.0/24>>
  DisableForwarding no
  AllowTcpForwarding yes
  X11Forwarding no
  AllowAgentForwarding no
  PermitTunnel no

(replace network address by your proxmox management subnet)